App Control: Agents Remain Disconnected After Recent Certificate Expiration and Renewal

[#1]

Environment

• App Control Server: 8.9.4 - 8.10.0
• App Control Agent: All Supported Versions

Symptoms

• Agent Server Communication Certificate expired, causing all Agents to become disconnected.
• Communication Certificate was replaced, but Agents remain in a disconnected state.

Cause

By default the Server will prioritize the previous Communication Certificate for 60 minutes after it is replaced. In the event this certificate was expired, this prioritization caused the Agents to remain in a disconnected state.

Resolution

This issue was tracked under EP-19021 and resolved with the release of Server 8.10.2. Previously the workaround involved:

1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
2. Select the Property CertificateDelaySwapMinutes and change the Value to 0
3. Restart the App Control Server service.
4. Verify the Agents are once again showing as Connected.
5. Return the Property CertificateDelaySwapMinutes to the default Value of 60

Additional Notes

• The steps are not necessary if the Communication Certificate is/was replaced prior to expiration.
• This setting is meant as a way to allow time for the Communication Certificate changes to be downloaded by the Agents.

Related Content

App Control: How to Replace Server Certificate in Version 8.x and Higher